netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4 get att (called from nc4 get att tc and nc get att text) and in uffd cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).